The @sumoinc/trashpanda npm package is identified as malicious software that, when installed or executed, results in full compromise of the host computer. This compromise includes potential unauthorized access and control by an external entity. Due to the severity of the compromise, all sensitive credentials on the system must be rotated from a secure environment. The package removal does not assure complete remediation because the attacker may have deployed additional malicious components beyond the package itself.

Full system compromise on any computer with the package installed or running. All secrets and keys on the system are considered exposed and must be rotated. The attacker may maintain persistent access even after package removal, posing ongoing risk.

Immediately remove the @sumoinc/trashpanda package from affected systems. Rotate all secrets and keys stored on the compromised computer from a separate, secure device. Conduct a thorough investigation and remediation of the affected system, as removing the package alone may not eliminate all malicious software or attacker access.